Chip-Off Forensics

From ForensicsWiki
Revision as of 12:23, 30 October 2013 by Kwallster (Talk | contribs)

Jump to: navigation, search

Definition

From Wikipedia (http://en.wikipedia.org/wiki/Mobile_device_forensics#Forensic_desoldering):

Commonly referred to as a "Chip-Off" technique within the industry - this is the last and most intrusive method to get a memory image is to desolder the non-volatile memory chip and connect it to a memory chip reader. This method contains the potential danger of total data destruction: it is possible to destroy the chip and its content because of the heat and possible physical damage from desoldering.

Forensic Application

Chip-Off forensics is an acquisition procedure which involves physically removing the NAND or flash IC from a device and reading it directly on an external NAND/Flash reader. It is considered a last-option technique, as repairing the phone to a working state post-IC removal, is quite difficult.

Tools and Equipment

Procedures